European Grid Infrastructure EGI Trust Anchor release 1.112         2021.08.16

------------------------------------------------------------------------------
   For release DOCUMENTATION available on this EGI Trust Anchor release see   
               https://wiki.egi.eu/wiki/EGI_IGTF_Release                      
------------------------------------------------------------------------------

This is the EGI Trust Anchor release, based on the updated IGTF Accredited CA
distribution version 1.112-1 with the specific DOGWOOD CA in
meta-package "ca-policy-egi-combined-adequacy-model-1.112-1"
that supports the model of joint assurance provision as detailed in the
EGI Policy on Acceptable Authentication Assurance.

The following notices are republished from the IGTF, inasfar as pertinent to
this release. Details are found in the newsletter https://www.eugridpma.org/

Changes from 1.111 to 1.112
---------------------------
(16 August 2021)

* Updated ANSPGrid CA with extended validity date (BR)

The CA modifications encoded in both "requires" and "obsoletes" clauses (RPM)
and Conflicts/Replaced clauses (Debian)  have been incorporated in the above-
mentioned meta-packages.  This release is best enjoyed with  fetch-crl v3  or 
better, available from GNU/Linux OS add-on repositories Fedora, EPEL, Debian,
and from the IGTF at https://www.igtf.net/fetch-crl

  IMPORTANT NOTICE:
   This release contains a new "cam" (combined assurance/adequacy) package 
   based on the approved policy on differentiated assurance. See details on
   the EGI Wiki at https://wiki.egi.eu/wiki/EGI_IGTF_Release#cam-impl
  TECHNICALLY THIS MEANS THAT
   you must ONLY install the new ca-policy-egi-cam packages if you ALSO
   at the same time implement VO-specific authorization controls in your
   software stack. This may require reconfiguration or a software update. See
     https://wiki.egi.eu/wiki/EGI_IGTF_Release#cam-impl
  OTHERWISE
   just only install or update the regular ca-policy-egi-core package. There 
   are no changes in this case. The ca-policy-egi-core package is approved for
   all VOs membership and assurance models. No configuration change is needed.

Policy on Acceptable Authentication Assurance (Updated 1 Feb 2017)
------------------------------------------------------------------
If a VO registration service or e-Infrastructure registration service is
accredited by EGI to meet the approved authentication assurance, an IGTF 
"DOGWOOD" accredited Authority - used solely in combination with said 
registration service - is also adequate for user authentication. See 
the policy at https://documents.egi.eu/document/2930 for details.
This additional restriction policy must be implemented by each service 
in the authorization software. The "combined assurance" model package MUST NOT 
be installed unless the additional authorization is in place. You will need 
to reconfigure and may need to install upgrades.

Version information: ca-policy-egi-combined-adequacy-model = 1.112-1